Rewrite DNSSEC Validation subchapter in the ARM

Mostly deduplicating and linking information across the ARM.
Generally people should not touch it unless they what they are doing, so
let's try to discourage them a bit.

(cherry picked from commit bffa3063f0c624ef3efcd9dfa882eac95542f3e1)

diff --git a/doc/arm/reference.rst b/doc/arm/reference.rst
index 041b002db8db069c80dbcbe4c232644e56305385..c96b029df449863b014dc62972147fae811a41d5 100644 (file)
--- a/doc/arm/reference.rst
+++ b/doc/arm/reference.rst
@@ -2074,7 +2074,9 @@ Boolean Options
    This option enables DNSSEC validation in ``named``.
 
    If set to ``auto``, DNSSEC validation is enabled and a default trust
-   anchor for the DNS root zone is used.
+   anchor for the DNS root zone is used. This trust anchor is provided
+   as part of BIND and is kept up-to-date using :ref:`rfc5011.support` key
+   management.
 
    If set to ``yes``, DNSSEC validation is enabled, but a trust anchor must be
    manually configured using a ``trust-anchors`` statement (or the